Vulnerability · high · CVSS 7.4
CVE-2026-18394: agent HTTP tool proxies parameter leaked credentials
Tier B · Patch this week – Put it in the sprint
Who’s exposed: strands-agents-tools users using http_request with HTTP_REQUEST_TOKEN_CONFIG
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Secrets exposed
The Brief
- CVE-2026-18394 is a credential leak in the http_request tool of strands-agents-tools.
- Operators could bind a token to approved hostnames with HTTP_REQUEST_TOKEN_CONFIG, but the proxies parameter route bypassed that allowlist.
- The advisory is GHSA-qhw6-2h72-m84v, and AWS published bulletin 2026-069-AWS.
Why it matters
Developers who rely on hostname allowlists to protect tokens in agent HTTP tools may have had credentials sent to unapproved destinations through the proxies parameter.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: strands-agents-tools is a developer library for building AI agents. |
| No | Core infrastructure | Judgment: a single agent-tools library, not shared core infrastructure like OpenSSH or GitHub. |
| No | Popular tool | Judgment: a specialized AWS agent SDK add-on, not a mainstream framework or platform. |
| No | Exploited in the wild | DEV Community: describes a credential leak; no source reports observed attacks. |
| No | Public exploit | DEV Community: excerpt cites advisory and AWS bulletin; no source says exploit code is published. |
| No | Remote, no login | CVSSCVSS: CVE-2026-18394 AV:N/PR:N/UI:R |
| No | Full takeover | CVSSCVSS: no CVE has both high confidentiality and integrity impact |
| Yes | Secrets exposed | DEV Community: 'a credential leak in the http_request tool' leaked credentials from the agent tool. |
| No | Supply chain | DEV Community: a flaw in legitimate code, not malicious code shipped through a trusted channel. |
| No | No fix yet | DEV Community: excerpt does not say whether a patched version is available. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-18394 ↗CVSS 7.4 high AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 45% of all CVEs
- Weakness
- CWE-863
Timeline
CVE-2026-18394 advisory (GHSA-qhw6-2h72-m84v) and AWS bulletin 2026-069-AWS published
DEV Community: python
The Allowlist Guarded the Destination, Not the Route: A Proxies Parameter Leaked Credentials From an Agent HTTP Tool
Source
The Allowlist Guarded the Destination, Not the Route: A Proxies Parameter Leaked Credentials From an Agent HTTP Tool ↗ DEV Community: python · 1h ago
First seen · 1 source · Full story page · How tiers are decided